Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, Velociraptor) and Sigma detection rules. Use when hunting for service-account misuse or investigating a service account performing unexpected interactive logons.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-service-account-abusenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-service-account-abuse -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-service-account-abuse -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-service-account-abusegh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-service-account-abusegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-service-account-abuse ~/.claude/skills/detecting-service-account-abuse # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-service-account-abuse ~/.agents/skills/detecting-service-account-abuse # Codex, Cursor, Gemini CLI, Copilot, OpenCode